If there any open source solution for forticlient ipsec vpn as a second factor for 2fa

VPN
1

Hey everyone! I have fg 600d with 1000 ipsec users via forticlient, if there any open source solution to integrate second factor (mobile app most preferable) for this

2

Maybe try https://www.privacyidea.org/

i have not tested it myself but it seems nice…

3

Or any other open source solution to implement client vpn with mfa?

4

Are you asking for an open-source VPN client, or for an open-source 2FA/MFA provider?

5

You could try saml with a provider that uses 2fa in the authentication flow. Then the saml provider wil handle the login and mfa options
An example is authentik

6

Back in the day I built one with forge rock and freeradius

7

If you’re looking for Open Source, I believe multiOTP is compatible with FreeRADIUS and is a TOTP/HOTP token server. You should be able to use that with any mobile TOTP app such as Google Authenticator.

8

Implemented that project with LinOTP once, when pandemy hit and everyone had to switch to WFH. Well, PrivacyIDEA is essentially the same.

Basically you’ll get a management/enrollment web-portal (AD-tied) and web-endpoint for 2FA. Then you’ll need FreeRADIUS installation with LinOTP-plugin pointing to that endpoint.

9

You could look at either Keycloak or Authetik as SAML providers and use Google authenticator with them. There are no app based 2fa solutions that are Open source as far as im aware.

10

People still use Dailup IKE in 2023? TIL.

11

If you want free use pfsense. You can pin hole it

12

Please clarify, are you looking for an open source solution because you want to review the software client source code? Or are you looking for a solution that is no cost?

13

Vpnhouse seems to suit you, take a closer look, there is a good VPN and an application.

14

Yes, if I’m not mistaken Vpnhouse provides such conditions. It’s worth a try at least.

15

This, we use it

Some features require a support contract but the basic MFA with software tokens is free

16

I’m using forticlient vpn as a VPN client, and looking for 2fa provider.

17

Thanks! Is a forge rock free?

18

If you have Azure AD or Google workspace you can use SAML to auth users with the same MFA as I hope you use for webmail.

One less account for people to remember and one less account to create/remove as users come and go.

19

It was 9 years ago and yes it was free

20

Azure AD SSO for Forticlient is really slick as well, have it on a customer site and little to no complaints about it